Roles Custom Claim is Empty after Roles Are Set on User Creation (via Auto-import)
Last Updated:
Overview
We have Auth0 Actions set up on the Login flow to do the following.
1. Update a user's roles from our CRM
2. Add a custom claim to the user's ID and access tokens.
When a user that already exists in Auth0 logs in, both of these actions are performing correctly. If the user's roles differ from the roles in our CRM, they are correctly added/removed and the custom claims reflect the new set of roles. However, the first time a user logs in, the roles are added from the CRM, but when we were setting the custom claim from the user's Auth0 roles the custom claim was empty. As a workaround, for now we are directly setting the custom claim from an API call to our CRM - but it would be a cleaner solution if the custom claim was set correctly on first login.
Symptoms
Event object does not update between actions when using the Management API within an action (similar implementation to: https://community.auth0.com/t/how-do-i-call-my-api-from-an-action/69041)
Steps to reproduce
Make a change to the user's profile with a Management API client within an Action
Attempt to use the event object later in the Action flow and fetch the new values.
Event object is not updated by Management Client changes, so will require another login attempt to get the updated profile in the event object.
Applies To
- Actions
- Management API
- Auto-import
- Roles
Cause
It appears that any changes made to the current user via calling the Management API from an Action does not update the event object for future actions in the flow.
Troubleshooting
Check customer extensibility code for how changes to user are made.
Using the Action's API object allows updates to be persisted for the next action in the flow, e.g. setting metadata.
Solution
Changes made to the user's profile by using a Management Client such as in this example:
Will update the user's profile but not the event object. Unfortunately there is not a way currently to update the event object otherwise, and changes to the profile won't be picked up until the next login
The exception is metadata using the built in Action API object to set metadata, which will update the event object for that metadata:
